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CONTROL AND PROTECTION SYSTEM FOR PARALLELED MODULAR 
STATIC INVERTER -CONVERTER SYSTEMS 
by Arthur G. Birchenough and Francis Gourash 
Lewis Research Center 

SUMMARY 


The versatility of a modular power conditioning system is greatly enhanced by the 
addition of an effective control and protection system. A program was initiated to de- 
velop a control and protection system for a modular inverter- converter power system. 
The operation and performance of the control and protection system is discussed. 
Boolean equations and detailed circuit descriptions are presented. 

The control and protection system developed senses primarily output voltage, out- 
put frequency, output current, and paralleling current imbalance . A logic system con- 
trols contactors to control parallel module operation and to isolate defective power con- 
ditioners or loads. A control and monitoring panel is provided for both manual and 
automatic control of the inverter- converter system. The control and protection system 
was developed for use with 2. 5-kilowatt, 150- volt dc or three-phase, 120- volt, 400- 
hertz modules. The modules operate with a dc input of 56 volts. 


INTRODUCTION 

As the electrical power requirements of spacecraft increase, a modular approach 
becomes a realistic solution to power conditioning requirements. Basically, the modu- 
lar approach involves the parallel operation of low-power modules to form multikilowatt 
inverter- converter systems. The modular concept provides flexibility, reduced design 
time, and reduced cost through the use of standardized modules. Repair and replace- 
ment of modules would also be feasible on manned missions. 

Parallel operation of modules also increases reliability if an automatic control and 
protection system is incorporated. Power system faults such as improper voltage and 
frequency, paralleling unbalance, current overloads, and bus faults would be detected. 
Contactors in the distribution system would then isolate the defective power conditioners 



or loads with a minimum disturbance to the rest of the power system. A control and 
monitoring panel would aid in fault identification and provide for manual override of the 
automatic operation. The automatic operation could provide for fault checking and tran- 
sient overload capabilities. 

A control and protection system was, therefore, designed and fabricated by the 
Westinghouse Aerospace Electrical Division, under Contract NAS3-9429, and previous 
contracts (refs. 1 and 2) as part of a modular power conditioning system. This system 
also included the inverter and converter, the paralleling circuits, a distribution system, 
and a control and monitoring panel. The system concepts were based on existing air- 
craft systems. At the Lewis Research Center the entire power conditioning system was 
tested and modified to improve the performance. This report presents the design and 
performance of the control and protection system, including the control and monitoring 
panel and the distribution system. The basic modules in this system are 2. 5 kilowatt, 
150 volt dc or three phase, 120 volt, 400 hertz. Other portions of this power condition- 
ing system have been reported previously (refs. 3 to 5). 


DESCRIPTION OF CONTROL AND PROTECTION SYSTEM 

The control and protection system consists of four major parts: 

(1) A distribution system 

(2) Sensors which monitor the power system operation 

(3) A logic interface between the sensors and the distribution system 

(4) A control and monitoring panel 

A modular power system with two modules is illustrated in figure 1. Each module 
consists of a power conditioner with paralleling circuits, the control and protection sys- 
tem, sensors and logic, a distribution system (the contactors), and a control and moni- 
toring panel. Detailed descriptions of the circuits are given in appendix A. 


Distribution System 

The power conditioner is isolated from the input bus by the input contactor (IC) and 
connected to its load bus by the load bus contactor (LBC). All acronyms are defined in 
appendix D. Also connected to the load bus, through contactors, are the loads and the 
tie bus. The tie bus interconnects the paralleled modules. With this arrangement the 
loads may be powered independently from the module, or from the tie bus, or both. De- 
fective loads can be isolated so that the module can continue to feed the tie bus. Gener- 
ally, the load contactor (LC) would feed several loads in parallel and each of these loads 
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Figure 1. - Modular power system. Distribution system in each module consists of the input, load, load bus, 
and tie bus contactors. 


would be fused. The inverter module is three phase, and all contactors and buses are 
three phase. In the dc system, the three poles of each contactor are connected in series 
to interrupt the positive side of the 150- volt dc bus. 


Sensors 

The sensors are indicated in figure 2. These sensors detect internal power condi- 
tioning faults and load or distribution system faults. Specifically, the frequency refer- 
ence protection (FRP) checks the output voltage and frequency of a crystal- controlled 
oscillator. This oscillator controls timing operations and the output frequency in each 
inverter (ref. 3). The inverters are synchronized by using only one of these crystal 
oscillators (the frequency reference) to control all the inverters. Failure of the fre- 
quency reference requires that the control be transferred to another oscillator or the 
entire power system will be shut down. One oscillator in each module is available for 
use as the reference oscillator. 

The overvoltage and undervoltage (AV) and overfrequency and underfrequency (AF) 
circuits check the output voltage and frequency of the inverter. These are three-phase 
sensors for the inverter and a fault on any phase will be detected. 

The excessive ripple (ER) circuit checks for excessive 9.6-kilohertz ripple in the 
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Figure 2. - Sensors. 


inverter output waveform. The inverter uses a carrier cancellation technique (refs. 3, 

5, and 6) to eliminate the basic carrier frequency (9. 6 kHz) ripple. A failure in an in- 
verter may result in a loss of output from one of the four paralleled output stages. This 
failure would reduce the maximum output power by 25 percent. But the only externally 
noticeable effect is the increased 9. 6-kilohertz ripple. The carrier cancellation tech- 
nique which reduces this ripple requires balanced outputs from the four output stages. 

The AV, AF, and ER sensors axe connected to sense the power conditioner output 
before the LBC. Only the AV sensor is used in the converter mode. Therefore, with 
either the LBC or the tie bus contactor (TBC) open, the power conditioner is checked 
independently of the other modules. A fault detected by any of these sensors will open 
the LBC and IC, which completely isolates the defective power conditioner. The TBC 
and LC may remain closed so that the load can be powered from the tie bus. 

To detect and correctly identify an overload, both power conditioner output current 
and load current are measured. A fault detected by the load overcurrent (LOC) sensor 
will open the LC. A fault detected by the inverter overcurrent (IOC) sensor or the con- 
verter overcurrent (COC) sensor will open the TBC. If both the LOC and COC or IOC 
sensors detect a fault, the LC will be opened. If the IOC or COC fault still exists after 
the LC is opened, the TBC will be opened. If only load current and tie bus current were 
measured, the power conditioner output current could be above its maximum rating with- 
out either sensor indicating a fault. 

The load division protection (LDP) sensing circuit checks for proper load current 
sharing when the modules are operating in parallel. A LDP fault opens the TBC, and 


4 






the isolated module supplies its own load. In the converter mode, an automatic parallel 
(AP) sensing circuit determines if the tie bus voltage is correct before the TBC can be 
closed. This circuit is permissive if the tie bus voltage is zero (no converters tied to 
the bus) or if the tie bus voltage is 150 volts dc. (There is a large filter capacitor on 
the output of the converters; and closing into a fault in the converter mode would cause 
a current surge, possibly damaging the contactors or the output filter. ) This circuit is 
not used in the inverter mode. 


Logic Interface 

The logic interface between the sensors, the contactors, and the control and moni- 
toring panel is shown as a block diagram in figure 3 . The equations governing the logic 
are given in appendix B. In general, the logic controls and sequences the contactors as 
dictated by the fault sensors and the control switches on the control and monitoring 
panel. 



Signals from 
other modules 


Parallel control signal 
Ito power conditioner) 


Contactors 


Control and monitoring 
panel lights 


Control and monitoring 
panel switches . 


Signals to other 
modules 


Figure 3. - Logic interface. 
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A parallel control signal is generated to energize the inverter- converter paralleling 
circuits . An FRP transfer signal controls switching to another synchronizing reference 
signal. The FRP transfer signal interconnects with the other modules. 

The logic is designed with a recycle feature such that, in case of a fault, a contac- 
tor or contactors will be opened. After a time delay of approximately 0. 5 second, the 
contactors will be reclosed to see if a fault still exists. The circuit recycles twice be- 
fore setting a latch circuit which will hold the contactor open. This latch circuit can 
only be reset by manually recycling the startup sequence. If three faults do not occur 
within 15 seconds, the counter is reset; and three more faults will have to occur before 
the latch will be set. The recycle operation is controlled by the recycle and fault count- 
er. An overcurrent fault, for example, may also cause load sharing and undervoltage 
faults. Time delays are used in the logic to determine the primary fault and the proper 
corrective action. 

The modules are rated for 50-percent current overload for 10 minutes. If the cur- 
rent is between 110 and 150 percent of rated, a timer in the control and protection sys- 
tem is started. If the overload continues for 10 minutes, a contactor will be opened to 
isolate the fault. The 10-minute overloads are not checked by recycling. An overload 
in excess of 150 percent of rated current causes immediate opening of the contactor, 
but the recycle circuit is used. 


Control and Monitoring Panel 

The control and monitoring panel consists of 19 lights and five switches. Besides 
the sensor outputs and signals from other modules, these switches are the only inputs 
to the logic. These switches allow manual override of the automatic controls. The 
logic controls seven lights which indicate switch and contactor positions and six lights 
which indicate the following faults: abnormal voltage (AV); abnormal frequency (AF); 
frequency reference protection (FRP); load division fault (LDF); load bus fault (LBF); 
and tie bus fault (TBF). Additional lights indicate parallel or isolated operation, man- 
ual or automatic control, and inverter or converter mode of operation. 


SYSTEM PERFORMANCE 


A typical normal startup of an inverter module, which illustrates the timing and 
contactor closure sequence, is shown in table I. The startup is shown for automatic 
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TABLE I. - TYPICAL STARTUP 


Time, sec 


Sequence 

Input contactor closed 
Input contactor switch light off 


0.8 


Load bus contactor closed 
Load bus contactor light on 
Isolated operation light on 


3.5 


Tie bus contactor closed 
Tie bus contactor light on 
Parallel control on 
Parallel operation light on 
Isolated operation light off 


End of cycle 


TABLE H. - 

TYPICAL FAULT SEQUENCE 

Time, sec 

Sequence 

0 

Input contactor closed 
Input contactor switch light off 

3.75 

Abnormal frequency light on 
Input contactor open 

4.3 

Input contactor closed 
Abnormal frequency light off 

m 

Input contactor open 
Abnormal frequency light on 

8.2 

Input contactor closed 
Abnormal frequency light off 

11. 4 

Input contactor open 
Abnormal frequency light on 

12. 1 

Tie bus contactor closed 
Tie bus contactor light on 


End of cycle 






























operation into a parallel mode. Before startup, the control and protection system is 
energized, and the load contactor (LC) is closed. All other contactors are open. At 
t = 0, the input contactor switch (ICS) is closed. 

At t = 0, the IC is closed, so the power conditioner starts. If no faults are de- 
tected, the LBC is closed after 0. 8 second. The loads connected to the module are 
energized when the LBC closes. After a 2. 7- second time delay (and if the AP circuit 
is permissive in the converter system), the TBC closes and the parallel control signal 
which activates the paralleling circuits is generated. 

All other lights except the converter mode light, the isolated operation mode light, 
and the fault indicators would also be on. If the manual override switch (MOS) was on, 
the timing and sequence would be unchanged, unless an LBC or TBC switch were open. 

In that case the contactor would not close, and the parallel control signal would not be 
on. 

Table n illustrates a startup when the inverter has an abnormal frequency (AF) 
fault. If the fault had occurred after the inverter had been on, the timing and sequence 
would be essentially unchanged; but the TBC and LC would remain closed, supplying 
uninterrupted power to the loads from the tie bus. If the module was supplying the fre- 
quency reference signal, FRP faults would also be indicated during the sequence. At 
the end of this sequence, a latch has been set which will hold the IC and LBC open until 
the module is restarted by opening and closing the IC switch. 

The set points for the sensors are listed in table HI. The set points are generally 
adjustable and usually were left as set by the contractor. In some cases the set points 
are very wide because of noise problems, as discussed in appendix A. 

A truth table is given in table IV to indicate faults which will open a contactor. The 
truth table does not show conditions to close a contactor, which may be different, or to 
switch overrides in the manual mode. A more complete analysis of the logic is given in 
appendix B. 

Some faults will open a contactor during the fault isolation sequence (recycling), 
but the contactor will be reclosed at the end of the sequence. An example is an inverter 
overcurrent caused by a tie bus fault. The IC and LBC will open but will not remain 
open. 

Power consumption of the control and protection system was approximately 90 watts 
under normal operating conditions. Sixty- six watts of this was consumed by the contac- 
tors, and 11 watts by the indicator lights. Nearly one -half the remaining power was 
power supply loss, approximately 5 watts were actually consumed by the logic and 
sensors . 
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TABLE HI. - SENSOR SET POINTS 


Sensor 

Set point 

Difference from power 
conditioner opera- 
tion point, 
percent 

Inverter sensors 


Frequency reference protection (FRP) 

1 

25 kHz 

-35 


40 kHz 

+4 

Excessive ripple (ER) 

42 V rms 

(a) 

Abnormal frequency (AF) 

388 Hz 

-4 


493 Hz 

+20 

Abnormal voltage (AV) 

135 V rms 

+ 12 

Inverter overcurrent (IOC): 

85 V rms 

-29 

110- Percent sensor 

11. 5 A rms 

+5 

150- Percent sensor 
Load overcurrent (LOC): 

14. 5 A rms 

-5 

110- Percent sensor 

11.5 A rms 

+5 

150- Percent sensor 

14.5 A rms 

-5 

Load division protection (LDP) 

1. 15 A rms 

(b) 

Converter sensors 


Abnormal voltage (AV) 

135 V dc 

-10 

Converter overcurrent (COC): 

168 V dc 

+12 

110- Per cent sensor 

16 A dc 

-14 

150- Per cent sensor 
Load overcurrent (LOC): 

21 A dc 

-24 

110- Percent sensor 

17 A dc 

-8 

150- Percent sensor 

27.5 A dc 

+ 15 

Load division protection (LDP) 

1 . 5 A dc 

(c) 

Automatic parallel (AP) 

168 V dc 

+ 12 


135 V dc 

-10 


22 V dc 

(d) 


a Maximum 9. 6-kHz ripple, 1.2 V rms. 

^Seven percent above 10-percent maximum load unbalance. 
c One percent above 10-percent maximum load unbalance. 
^Normal voltage is zero. 
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TABLE IV. - FAULTS THAT OPEN CONTACTOR 


Contactor 

Fault a 

Frequency 

reference 

protection 

(FRP) 

Abnormal 

frequency 

(AF) 

Abnormal 

voltage 

(AV) 

Inverter 
over current 
(IOC) 

Load over- 
current 
(LOC) 

Load division 
protection 
(LDP) 

Input contactor 

1 

X 

X 

X 

X 

X 


X 

1 

X 

X 

X 

X 


X 

X 

1 

X 

X 

X 

Load contactor 

X 

X 

X 

X 

1 

X 

Load bus contactor 

1 

X 

X 

X 

X 

X 


X 

1 

X 

X 

X 

X 


X 

X 

1 

X 

X 

X 

Tie bus contactor 

X 

X 

X 

1 

0 

X 


X 

X 

X 

X 

X 

1 


a A "1" denotes signal which will open contactor. A "0" denotes signal must not exist for 
contactor to open. An "X" denotes signal has no effect. 


CONCLUDING REMARKS 

The capabilities of a modular inverter- converter system are significantly increased 
if an effective control and protection system is incorporated. The control and protection 
system detects and isolates defective elements and connects necessary loads to the avail- 
able power sources. The control and protection system described contains sensors 
which are simple and designed only to sense severe faults, which is sufficient to pro- 
tect the system. 

The control system was based on an aircraft- style distribution system, using non- 
latching contactors. Power distribution was interruptible because of time delays in the 
fault sensing and logic. Fault isolation was generally satisfactory. 

The transient overload protection was programmed to match the overload charac- 
teristics of the power conditioners with a recycle feature to check for fault clearing. 

A control and monitoring panel indicates system operating modes and allows manual 
or automatic control of the contactors but no override capability for sensor or logic 
errors. 
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Power consumption of the unit was high, approximately 90 watts. The primary 
cause of this high consumption was the contactors and indicator lights. 

Lewis Research Center, 

National Aeronautics and Space Administration, 

Cleveland, Ohio, January 8, 1973, 

503-35. 
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APPENDIX A 


CIRCUIT DESCRIPTIONS 

The circuit diagrams shown and discussed in this appendix are simplified drawings. 
Capacitors for noise suppression, redundant elements, and power supply connections to 
the integrated circuits are not shown. The reference voltages shown in the following 
figures are obtained from the 6-volt supply or from voltage dividers on the 10- volt 
supply. The reference voltages are not the same for each sensor, or even for two ref- 
erences in a single sensor . 

The principal sense element is an integrated- circuit differential input voltage com- 
parator (VC). The logic is all integrated- circuit diode-transistor logic (DTL). These 
are NAND gates, and the logic convention is that a low or "0" signal is zero volts and 
a high or "1" signal is +6 volts. Figure 4 illustrates the symbols used for the inte- 


+ 10 v 



+ 10 V 



+6 V 



+6 V 



e 0 = (A • B • 0 
(b) NAND gate. 


Figure 4. - Symbols used for integrated circuits. 
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grated circuits and a representative internal schematic. A complete schematic of the 
entire control and protection system is in appendix C. 

The breadboard modules are rack mounted and forced-air cooled. The low-level 
circuits of the control and protection system are on printed circuit or perf- board cards. 
A front view of a module is shown in figure 5(a). The control and protection is contained 
in the top cage. Fans are not required for this cage. 


Contactor Panel 

Figure 5(b) shows the contactor panel, on which are mounted voltage isolation trans- 
formers and current transformers and transducers . The contactors are nonlatching 
aircraft type and are powered from a 28-volt dc supply. Reconfiguring of the contactor 
wiring when changing between inverter and converter modes is accomplished by jumper 
wires on barrier strips. The contactor panel is shown with the jumpers arranged for 
inverter operation. 

The contactor wiring for the inverter and converter configurations is shown sche- 
matically in figure 6. The IC in both modes and the LC, LBC, and TBC in the converter 
mode are connected with the three poles in series to withstand the voltage. 


Converter Inverter 

mode mode 

lights dc link lights 



contactor 


Tie bus 


Module 

loads 


Tie bus 


Module 

loads 


(b) Converter configuration. 


Figure 6. - Contactor wiring. 
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Inverter Sensors 

Frequency reference protection sensor . The FRP sensor shown in figure 7 deter- 
mines the frequency of the 38. 4-kilohertz reference oscillator. The input to this circuit 
is a logic-level square wave. Gate 1 (Gl) is used for isolation and does not change the 
waveshape. A network consisting of resistor R2 and capacitor Cl filters the output of 
Gl, resulting in a dc level with some ripple. Because R2-C1 form a low-pass filter, 
the ripple amplitude is inversely proportional to the frequency. 

Underfrequency is sensed by VC1. The output of the R2-C1 filter is compared to a 
reference voltage which is slightly greater than the normal peak value of this output. If 


+v 



Figure 7. - Frequency reference protection sensor. 

the input frequency decreases, the ripple magnitude increases and VC1 will switch at 
each voltage peak, producing a "O'- signal. A compensation network, R3 and C2, re- 
duces the speed of the comparator so that once it switches, it will continue to put out a 
zero for approximately 50 microseconds.: Since the period of a 3 8- kilohertz wave is 
less than 50 microseconds, the output will stay low continuously. 

To sense an overfrequency, VC2 compares the R2-C1 filter output to a reference 
which is slightly less than the normal peak filter output. Thus, VC2 will switch to zero 
each cycle if the frequency is correct. The R4 and C3 function the same as R3 and C2 
in maintaining this zero. If the input frequency increases, VC2 will stop switching and 
its output will go high, indicating a fault. 

The detection thresholds were set at 25 and 40 kilohertz. The overfrequency sensor 
rejects noise pulses lasting less than the R4-C3 time delay. But the R3-C2 network on 
VC1 tends to increase the noise sensitivity because it acts as a pulse stretcher. There- 
fore, the underfrequency sensor threshold had.to.be set much. wider than the overfre- 
quency sensor. . 
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Excessive ripple sensor . - The ER circuit, figure 8, detects 9. 6-kilohertz ripple in 
the inverter output voltage. The input is three-phase line voltage, isolated from the in- 
verter outputs by a 1:1 transformer. Because of the 9. 6-kilohertz-series resonant fil- 
ters Cl-Ll, C2-L2, and C3-L3, only the 9. 6-kilohertz ripple appears across Rl, R2, 
and R3. The ripple is rectified and filtered by Dl, D2, D3, R4, and C4 and compared 
to a reference voltage in VC1. Positive feedback, hysteresis, is obtained through R5 
and R6. The maximum ripple on any phase will be detected by the ORing action of Dl, 
D2, and D3. 


Cl Ll Dl 



Excessive 

ripple 


The minimum input required for sensing is 42 volts rms. The ripple caused by a 
bridge failure is nearly an order of magnitude less than this voltage. The sensitivity of 
this circuit should be increased, or possibly the ripple current should be sensed, for 
this circuit to be functional. 

Output frequency sensors . - The input to the under frequency sensor, figure 9, is 
the three-phase inverter output obtained from the same isolation transformer used with 
the ER sensor. The 400-hertz sine-wave inputs are clipped into 400-hertz logic-level 
square waves by Rl-Dl, R2-D2, and R3-D3. Gates Gl, G2, and G3 combine these 
three-phase 400-hertz square waves into a 1200-hertz square wave at the inputs of G4 
and G5 . 

As in figure 7, R4, R5, and Cl form a low-pass filter, driven by G4 which is used 
for isolation (buffer). The comparator VC1 determines underfrequency in the same way 
as the underfrequency sensor of the FRP sensor. However, because of the much lower 
frequency, a time delay such as the R3-C2 combination of figure 7 becomes impractical. 
Instead, a flip-flop memory (G6 and G7) is used. 

This memory is set by G6 if an underfrequency fault is detected. But for each cycle, 
a reset pulse is generated by G5 and R6, R7, R8, D4, and C2. Positive feedback around 
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+V v ref 



VC1, provided by R9 and RIO, ensures that the pulse out of VC1 overlaps the reset pulse 
completely, producing a steady fault signal at the output of G7. Typical waveforms for 
the circuit, with an underfrequency fault, are shown in figure 10. 

Circuitry identical to that used for the underfrequency sensor is used to detect over- 
frequency. In fact, most of the parts used for the underfrequency sensor are used for 
the overfrequency circuit. Only the voltage comparator and flip-flop are separate. The 
reference voltage for the comparator is less than the normal peak amplitude of the ripple 
out of the R5-C1 filter, so the comparator normally switches each cycle. Its normal 
operation is identical to the underfrequency sensor when there is a underfrequency fault. 
The outputs of the underfrequency and overfrequency sensors are combined into one ab- 
normal frequency (AF) fault in the memory flip-flop of the underfrequency sensor. The 
ER circuit output is also NANDed in as an AF fault, as shown in the complete schematic 
in appendix C. 

The trip points for these sensors were set at 376 and 481 hertz. These sensors 
were less noise- sensitive than the FRP sensor because larger capacitors were used for 
filtering the low frequency. The sensors depend on a 120° phase shift between phases to 
generate the 1200-hertz square wave. Therefore, a large phase-shift error, or no out- 
put on one or more phases, will be detected as an AF error. The logic is programmed 
so that an undervoltage fault will not be indicated as an abnormal frequency fault. These 
sensors respond rapidly, sensing frequency in essentially a cycle-by-cycle basis. Time 
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■* 0. 833 msec H 



Figure 10. - Underfrequencysensorwaveforms. 


delays are incorporated in the control logic to prevent false tripping. 

Output voltage sensors . - The under voltage sensor, figure 11, must detect the low- 
est of the three-phase voltages. Each input goes through a voltage divider (R1-R2, R3- 
R4, or R5-R6) and a rectifier filter (Dl, Cl, R7, etc. ). The voltages on Cl, C2, and 
C3 will correspond to the three input voltages. 

Current flows from the +V supply through RIO and one of the diodes D4, D5, or D6. 
Current will flow only through the diode going to the capacitor with the least voltage on 
it, because the other two diodes will be reverse biased. Thus, V will correspond to 

a 

the lowest phase voltage. In VC1, V is compared to a reference voltage which is nor- 

d 

mally less than V , to indicate a fault. 

cL 


R1 Dl D4 RIO 



Abnormal 

voltage 
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Figure 12. - Overvoltage sensor. 


Overvoltage sensing is much less complicated, as shown in figure 12. The highest 
voltage is rectified by Dl, D2, or D3 and filtered by Cl. Voltage divider R1-R2 and 
VC1 compare the peak voltage to a reference to generate an overvoltage trip signal. 

The rated output voltage is 120 volts rms. The abnormal voltage sensors were ad- 
justed for 135 volts rms (112 percent of rated voltage) and 85 volts rms (71 percent of 
rated voltage). 

One set of isolation transformers is used for the ER, AF, and AV sensing. The 
total power consumed from the inverter output is approximately 2. 5 watts. Most of this 
power consumption could be eliminated by changing the technique for generating 400- 
hertz square waves for the AF sensors. 

Overcurrent sensor . - The inverter overcurrent and load overcurrent sensors 
(fig. 13) use current transformers as sense elements. Each current transformer (Tl, 


ipA ip B ipC 



Figure 13. - Inverter overcurrent sensor. 
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T2, and T3) has a burden (Rl, R2, or R3); and its output is rectified by Dl, D2, or D3 
and filtered by Cl. The output is then compared to a reference voltage corresponding 
to 110 percent of rated load current in VC1 or 150 percent of rated load current in VC2. 
After an overcurrent fault is sensed, a reset signal of 0 volts is used to discharge Cl 
through D4 as the logic starts to recycle. The inverter overcurrent and load overcur- 
rent sensors are essentially identical. 

The overcurrent trip points were set at 11.5 and 14. 5 amperes, corresponding to 
115 and 145 percent of rated load at 0. 7 power factor. These sensors do not detect real 
power; and with a unity power factor load, a 110-percent detector would trip at over 
150 percent of rated load. Thus, overpower as well as overcurrent sensors may be 
necessary. Each current transformer has a maximum insertion loss of approximately 
1/6 watt, a total of 1 watt for both three-phase sensors. 

Load division protection sensor . - The LDP circuit is shown in figure 14. Its oper- 
ation is based on a current transformer ring, which is described in reference 4. The 
points A and B for phase A, C and D for phase B, and E and F for phase C are connected 
in a ring with the corresponding points in other modules. Basically, the current in the 
burden resistor R2 (R3, R4) will be proportional to the difference between the A (B, C) 
phase output current of this module compared to the average output current of all the 
other A (B, C) phases. The current in R2 will cause a voltage across T4 proportional 
to the load unbalance. Correspondingly, T5 and T6 will have output voltages propor- 
tional to the phase B and phase C unbalance. The largest of these imbalance voltages 
will be rectified by D2, D3, or D4 and filtered by R7 and Cl and will be compared to a 
reference voltage by VC1. 

A gross fault in the load sharing in one module would often cause an LDP fault in 
several modules. In order to isolate only the defective module, the fault signals for all 
the modules are compared, and only the module with the largest fault signal is switched 
off the tie bus. The comparator VC2 and diode D6 determine the module with the larg- 
est fault. The points G of all the modules are tied together, and the voltage at this com- 
bined point will correspond to the greatest unbalance signal because of the diodes D6 in 
each module. Only the D6 in the module with the largest unbalance signal will be for- 
ward biased. This forward bias is detected by VC2; both VC1 and VC2 must switch to 
generate a LDP fault to the logic through Gl. 

The circuit is disabled for isolated operation by turning on Ql, through the LDP 
control. With Ql on, the current through Rl will saturate Tl, T2, and T3, essentially 
shorting out these current transformers. Diode D5 is required to limit the peak voltage 
to avoid damaging the integrated circuits. It also ensures that Cl will discharge to a 
low enough voltage during the recycle period that the LDP circuit will not still be indi- 
cating a fault when the logic begins a recycle. 
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Figure 14. - Inverter load division protection sensor. 


The LDP circuit would indicate a fault at 1. 15 amperes unbalance. This unbalance 
corresponds to 17-percent unbalance at rated load, 0. 7 power factor. The inverter 
paralleling circuits were designed for a maximum unbalance of 10 percent, and typical 
performance was approximately 5-percent unbalance. Circulating current around the 
current transformer ring is approximately 10 milliamperes, which would require only 
a very small conductor. Insertion loss of the sensing transformers is less than 1/4 watt 
per module. 
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Converter Sensors 


When the module is operating in a converter mode, a different set of sensors is 
used. Approximately the same faults are sensed as for the inverter. However, the 
output is now a single 150- volt dc bus instead of three phase and 400 hertz. 

Output voltage sensors . - The combined under- and overvoltage sensor is shown in 
figure 15. For the inverter sensors, transformers are used to isolate the power system. 
For the dc system, a chopper circuit is used. Resistors R1 and R2 reduce the input 
voltage, which is then chopped by Q1 and Q2. These transistors are driven at approxi- 
mately 2 kilohertz by the dc-to-dc converter circuit used in the control and protection 



Figure 15. - Converter under- and overvoltage sensor. 


system power supply. The output of the chopper is isolated by Tl, rectified by D1 and 
D2, filtered by Cl, and compared to two reference voltages in VC1 and VC2 to generate 
the under- and overvoltage fault signals. Voltage dividers R3, R4, and R5 set the trip 
level. 

The rated output voltage is 150 volts dc; the sensors were set for 135 and 168 volts, 
corresponding to 90 and 112 percent of rated. The chopper circuit had a transfer ratio 
of 0. 08. Therefore, for 150 volts input, the chopper output would be 12 volts. The 
chopper circuit consumed approximately 2. 5 watts. 

Over current sensors . - Full- wave magnetic amplifiers consisting of Rl, Tl, T2, 
Dl, D2, and Cl, are used for dc current sensing. The converter overcurrent (COC) 
circuit shown in figure 16 compares the magnetic amplifier output to two reference volt- 
ages to generate the 110- and 150-percent overcurrent signals. Gates G1 and G2 are 
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Figure 16. - Converter overcurrent circuit. 


used to lock out the COC 150-percent signal if a 150-percent load overcurrent (LOC) 
signal exists so that a tie bus fault will not be indicated. The LOC sensor is essentially 
identical except that the lockout circuit using G1 and G2 is omitted. Resistor R2 sets 
the trip level for comparators VC1 and VC2. 

The COC sensor had its 110- and 150-percent trip points set for 16 and 21 amperes, 
respectively, corresponding to 96 and 126 percent of rated current. The LOC sensor 
settings, at 17 and 27. 5 amperes, corresponded to 102 and 165 percent of rated load 
current. The 165 percent exceeds the capacity of the converter, which limits current at 
slightly above 150 percent of rated. 

Load division protection . - The converter LDP sensor operates in the same basic 
way as the inverter LDP sensor. A voltage is developed which is proportional to the 
unbalance. This is compared to a reference and also to the other modules to determine 
the most unbalanced modules. As can be seen in figure 17, the logic is the same but 
these parts are not shared with the inverter LDP sensor. 

The converter LDP sensor does not have its own current sensor. The output cur- 
rent, as sensed by the COC magnetic amplifier (fig. 16) is compared to the average out- 
put current in the T1-T2 D1-D4 magnetic amplifier in figure 17. One side of the input of 
this magnetic amplifier is connected to the same point on all the modules, resulting in 
an average current signal at this point. The difference in each module's COC signal 
from the average is amplified in the magnetic amplifier, filtered by Cl and Rl, and 
sensed by VC1 and VC2. The D5 and G1 function as in figure 14. 

The LDP sensor is disabled during isolated operation by the switch shown in fig- 
ure 18. The two connections which are switched are on the right. Gate G1 is used for 
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Figure 17. - Converter load division protection sensor. 
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Figure 18. - Zero-voltage switch. 

isolation and turns on Ql. Turning on Q1 closes a diode switch D1-D4, applying a 2- 
kilohertz square wave on the primary of Tl. The 2 -kilohertz wave is obtained from the 
control and protection system power supply. The square wave is then rectified by diode 
bridge D5-D8. The output voltage from this diode bridge turns on Q2, through Rl, 
causing a current to flow through R2 and D9-D12. The diodes have a very low imped- 
ance while in conduction. The switch is "on, " and current can flow through the "con- 
tacts. " The voltage drop across the switch will be very low (theoretically zero) if the 
diode voltage drops are matched and the signal current is much less than the current in 
the diodes. 

The LDP fault trip level is set for 1. 5 amperes, or 11 percent of rated load current. 
The performance specification on the converter paralleling network is 10 percent of 
.maximum unbalance. Typical performance is approximately 7. 5 percent. 

Automatic parallel . - An AP sensor is used to control converter system paralleling. 
This sensor monitors the tie bus voltage and will not allow the tie bus contactor to be 
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closed unless the tie bus voltage is correct. 

The sensor, figure 19, is very similar to the abnormal voltage sensor described 
previously. A chopper is used for isolation, and its output is measured by three com- 
parators. The comparator VC2 is an overvoltage detector and allows paralleling below 
168 volts. The comparator VC1 is an undervoltage sensor and allows paralleling only 
for a tie bus voltage above 135 volts. Voltage dividers R4, R5, and R6 determine these 
set points. Also, the tie bus contactor should be able to be closed if the tie bus voltage 



Automatic 

parallel 


is zero, because this could mean that no converters are connected to the bus. Transis- 
tor Q1 turns off for bus voltages less than 22 volts, determined by the divider R1-R2. 
Below 22 volts, with Q1 off, current flows through R3 and D2, causing VC1 to switch 
to a permissive state. Diodes D1 and D2 are an ORing circuit so that VC1 will check 
both zero and undervoltage states. The bands over which paralleling is allowed are then 
zero to 22 volts and 135 to 168 volts. 


Logic Circuits 

Frequency reference protection logic . - The FRP logic controls which module will 
supply the 38. 4-kilohertz reference signal. The FRP circuit, figure 20, has three in- 
puts and three outputs. One input is the 38. 4-kilohertz crystal oscillator signal from 
the module. This signal is ±12-volt square wave and is converted to logic levels by the 
network (Rl, R2, Cl, Dl, and D2) of Gl, where G1 is the control gate. If enabled, G1 
will allow the 38. 4-kilohertz signal to pass through Gl and the amplifier R3, R4, R5, . 
D3, C2, and Ql. This signal is then used for all the modules. 

For Gl to be enabled, all of its inputs except the oscillator signal must be high. 
The D input indicates if another module is supplying the reference signal. If D is low, 
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Figure 20. - Frequency reference protection logic. 


then G1 is disabled; and through G2 and G3, E will be low. The E of each module is 
connected to D of the next module in a chain technique . Only the first module in the 
chain has a D = 1 input, unless that first module has an FRP fault, in which case, its 
E will be "1, " and the next module will supply the reference signal, etc. 

The M input indicates if the input contactor switch is closed. If this switch is off 
(M = 0), there is no power to the reference oscillator; so a FRP transfer (E = 1) is sent 
out, and G1 is disabled. When the G1 is opened, a time delay using R6, R7, R8, R9, 

C3, Q2, and Q3 is started. This allows the oscillator to start before the FRP sensor 
determines if it is defective and locks it out. This time delay is primarily a reset signal 
to the G6-G7-G8 FRP fault memory flip-flop. 

An FRP fault signal, which turns on the FRP light, is generated only if the module 
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should be supplying the reference signal and has failed; that is, if D = 0 or M = 0, the 
FRP will not light even though the FRP sensor senses a fault. 

The FRP output stages (Ql, etc. ) must be paralleled so that any module can supply 
the reference signal. If G1 is locked out, then Ql is turned off for that module, and the 
output stage looks like an open circuit. In the module supplying the reference signal, 

Ql is switching on and off. Thus, the output is pulled up to +V by turning on Ql (active 
pullup), and then switches to a negative voltage when Ql is turned off because of resis- 
tors in the inverter (passive pulldown). 

Possibly the most questionable area in this protection system is the FRP system. 
Since many faults open the IC, the FRP circuit is often forced to transfer, and each 
transfer causes a transient in the inverters. One solution would be to relocate the crys- 
tal oscillator in the control and protection module. Another, possibly more suitable 
modification in terms of inverter reliability would be to open the IC only after the third 
fault and use an already existing internal inverter shutoff command to recycle the in- 
verter. This internal command does not interrupt the low- voltage supplies, so the 
oscillator continues to operate. Transfer would then occur only after the third fault. 

Transfer between FRP circuits due to switching the IC is very fast, and there is no 
noticeable transient in the output voltage. There may be internal transients, however, 
because the reference oscillators are not synchronized. However, the time required 
for an FRP fault detection and transfer causes some transient in the output voltage and 
will cause severe internal stresses, but has never caused traceable failures. 

Because the FRP logic is a chain, instead of a ring, the FRP transfer cannot pro- 
gress all the way around a loop. And, each time a module supplying a reference is 
faulted so that the IC opens, the reference is transferred. But the reference will trans- 
fer back each time the module automatically recycles. 

The FRP output stage must be sized according to the number of inverters it must 
drive. Each module requires 50 milliamperes from the reference, and a symmetrical 
low-rise-time square wave must be maintained. The present driver could handle ap- 
proximately three modules, a 10. 8-kilovolt-ampere system. 

Contactor control . - The contactor control has two major functions, the close and 
the trip circuits, shown in figure 21. Typically, each of these circuits has a multiple 
input gate (G1 or G2), a time delay (Rl, R2, Cl, and VC1 for the close circuit; R3, R4, 
C2, and VC2 for the open circuit), and a flip-flop memory (G3-G4 for closing or G6-G7 
for opening). 

Any "0" (enable) input on G1 will cause a "1” output on Gl. After a time delay of 
approximately 1 second for Cl to charge, the output of VC1 will go to zero. This sets 
the close flip-flop, if the G3 reset line and the trip flip-flop are high. This is the nor- 
mal condition. With the G3-G4 flip-flop set, e Q will be a "1" because of the inversion 
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in G5 . The contactor driver (shown in appendix C) is essentially a power NAND gate : 
all "l’s" on the input will close the contactor. 

The operation of the trip circuit is the same as the close circuit. Also, a fast trip 
line may be included to bypass the time delay. The time delay is primarily used to 
eliminate false trips on noise pulses and to ensure the correct sequence of contactor 
closures. 

Once the trip flip-flop is set, it will hold the contactor open until a reset is received 
from the IC reset or the recycle circuit. 

Ten- minute timer . - The 10-minute timer, figure 22, is a two-stage analog- digital 
hybrid. The timing action is started when a "0" is received at either A or D, repre- 
senting a 110-percent IOC or 110-percent LOC fault. A ”0" at A generates a "O’’ at the 
output of G2 through G3, which turns Q2 off. The Rl-Ql form a current source which 
charges Cl. In approximately 26 seconds, VC1 switches, turning on Q2 and Q3; and 
Q2 discharges Cl. During this discharge time, which is approximately 20 milliseconds 
as determined by the R2-C1 time constant, C2 is charged by current source R5-Q3. R3, 
R4, Dl, and D2 provide hysteresis and isolation. When Cl is discharged, VC1, Q2, 
and Q3 turn off; and Cl begins charging again. For each cycle, the voltage on C2 in- 
creases. After 21 cycles, approximately 10 minutes, the voltage on C2 exceeds V re £j 
and VC2 turns on, sending a signal out the "A + 10 minute" line. 

Gate G1 and Q4 are used to discharge C2 when the fault disappears. Gates G4, G5, 
G6, and G7 control the fault signal steering so that one timer is used for both overcur- 
rent delays. The 10-minute delay is complicated because very low- input- current opera- 
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tional amplifiers were not readily available at the time the system was designed. Be- 
cause of its complexity, one timer was used for both the IOC and LOC delays, which 
could cause undesirable interactions. Also, the timer resets immediately if the current 
momentarily drops below the 110-percent level. This resetting does not track the ther- 
mal conditions in the inverter as it should. 

Third-fault logic . - The three-fault counter and one of the third-fault latches is 
shown in figure 23. The fault inputs are NANDed together in Gl. A "0" at any input will 
start the cycle. After a time delay caused by R1 and Cl, VC1 puts out a pulse, which is 
counted by the flip-flop. During this pulse, whose width is determined by R2 and Cl, 

G2 generates a recycle reset pulse, which allows the contactors to reclose. 

After three counts, Q1 and Q2 outputs of the flip-flop will both be "1"; and, for 
example, there will be a "1" on the IC-LBC fault line. The G5-G6 latch will then be set 
by G4, generating a third-fault signal which will keep the contactor open and generating 
a fault signal for the annunciator. 

Gate G3 and VC2 are used to reset the counter to zero if three faults are not re- 
ceived within 15 seconds. If the counter output is "0, " the output of G3 will be low. If 
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Figure 23 . - Fault logic. 


the count is not "0, ” G3 goes high and C2 starts charging through R3 and R4. After 
15 seconds, VC2 resets the counter to "0. " Gate G7 provides a fault signal to the lamp 
drivers for the annunciator. 

Multiple faults occurring within the same 15-second period will cause abnormal re- 
cycling, but the faults will be isolated. The only incorrect operation noted was if an 
inverter fails while in parallel operation. Both an AV and an LDP fault will be sensed. 
The TBC is opened as a result of the LDP fault, and the module shuts off as a result of 
the AV fault. The TBC remains open, and the load cannot be supplied from the tie bus. 
Most of the interactions were eliminated by the time delays. The preceding example is 
the only noted interaction which caused anything more serious than an incorrectly lit 
bulb. 

Lamp drivers. - The typical circuit used to drive the bulbs on the control and moni- 
toring panel is shown in figure 24. For the bulb to light, Q2 and SCR1 must be on. Nor- 
mally, Q2 will be on. (A is normally "1, " so Q1 turns Q2 on through Rl. ) To allow 
SCR1 to commutate, Q2 is turned off. If all its inputs (B, C, D, etc. ) are high, SCR1 
is turned on. Diodes Dl, D2, and D3 and R2 perform the NAND function. The B, C, 
and D inputs will generally be the fault signal, a contactor position, and possibly a logi- 
cal interlock, as with the AF and AV circuits and the IOC and LOC circuits. To improve 
the noise threshold at the B-C-D inputs, Cl, D4, D5, and R3 reverse bias the gate- 
cathode junction of SCR1. 
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Figure 24. - Typical lamp driver. 


Power Supply 

The input power for the module is a 56-volt dc bus. The control and protection sys- 
tem has a dc-dc converter self-contained. This converter supplies 28 volts dc for the 
lights and, in conjunction with a series regulator, +10 and +6 volts dc for the sensors 
and logic circuits. In addition, a separate 28-volt dc supply is incorporated to operate 
the contactors. 

The power consumption, less contactors, is typically 24 watts at 56 volts dc. The 
contactors consumed an additional 66 watts. The power consumption could have been 
reduced significantly by using latching contactors and lower power indicators. The 
power required for the sensors and logic was approximately 5 watts. 
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APPENDIX B 


LOGIC SYSTEM EQUATIONS 

The logic system has five major outputs: the four contactors and the parallel con- 
trol signal, and the indicators lights. The inputs to the logic are all digital signals; 
they come from the control switches on the control and monitoring panel or from the 
sensors. 

There are five control switches, all located on the control and monitoring panel. 
They are the input contactor switch (ICS), the load contactor switch (LCS), the load bus 
contactor switch (LBCS), the tie bus contactor switch (TBCS), and the manual override 
switch (MOS). 

The ICS is essentially the on-off control for the module. If the ICS is open, only 
one contactor can be closed, and there is no power delivered to the power conditioner, 
the tie bus, or the loads. 


Input Contactor 

The ICS is the manual control switch for the input contactor. However, several 
other conditions must be met before the input contactor will close. The operation of the 
IC can be explained by the following equation: 

IC = (ICS)(IC latch) |Fault reset + (IOC^q + AF + AV) x (ICS + Fault reset) x 3. 75 secj 

The interpretation of the equation follows : There are three basic requirements for 
the IC to be closed, as indicated by the brackets. First, the ICS must be closed. Sec- 
ond, the IC latch must not be set. This latch is set if the faults counter indicates three 
faults which open the IC, or if a 10-minute power-conditioner 110-percent current over- 
load (IOC 110 x 10 min) has occurred. The third condition is that either a fault reset 
signal exists or that neither a 150-percent overload (IOC^q) nor AF or AV faults have 
occurred continuously for 3. 75 seconds after the ICS was closed or the fault reset sig- 
nal ended. The fault reset signal occurs after a contactor is opened to clear a fault; it 
starts the recycling feature. When the IC is first closed, the power conditioner has 
•been off; so AF and AV faults will be indicated. But after the power conditioner starts, 
the AF and AV faults are cleared within the 3.75-second delay period. 
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Load Bus Contactor 


The load bus contactor (LBC) has two control switches besides the ICS. These are 
the LBCS (load bus contactor switch) and the MOS (manual override switch). In the 
automatic position (MOS off), the LBCS does nothing. In the manual override position, 
the LBCS will open the LBC. The LBCS cannot close the LBC unless all the conditions 
for automatic closing are met. The equation for this contactor is 


LBC = ICS (MOS x LBCS + MOS)(IC latch) 

x [(AF + AV) x 0. 35 sec + LBC*][(IOC 150 + AF + AV) 

x 3. 75 sec (ICS + Fault reset)j 
This equation can be written in terms of the IC equation: 

LBC - IC(MOS x LBCS + MOS) [(AF + AV) x 0. 35 sec + LBC*] 

The LBC can be closed only if the IC is closed, and either the MOS is off or the 
LBCS is also on. Also, the contactor will close 0. 35 second after the AF and AV faults 
disappear and stay closed until 3. 75 seconds after a fault is sensed. The LBC' term 
indicates that the LBC is closed and that the 0. 35-second delay has no effect on opening. 


Load Contactor 

The load contactor (LC) has the simplest equation. The load contactor switch (LCS) 
will open the LC at any time, independent of the MOS and ICS. Also, only an LOC fault 
will trip the LC. 


LC = LCS(LOC^q x 10 min + LC latch)(LOCjgg x 1.3 sec + Fault reset) 

The LC is independent of the ICS and can be closed even if the ICS is open. Power 
cannot be delivered to the load, however, because neither the LBC or the TBC can be 
closed with the ICS off. 
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Tie Bus Contactor 


The tie bus contactor (TBC) is programmed to permit the closure either to parallel 
the modules or to connect the load to the tie bus if the module is defective. A TBCS is 
also included, which is functional only in the manual override position. The Boolean 
equation is 

TBC = ICS(MOS x TBCS + MOS)(TBC latch) [ 3 . 3 sec(LBC latch + AP x LBC)j 

x J^Fault reset + (IOC^gQ + LOP x LOC) x 1.5 sec 

The term containing LBC latch allows the TBC to tie the load to the tie bus if the 
LBC latch is set as a result of three LBC faults or a 10-minute IOC. 


Control and Monitoring Panel 

Control switches . - There are five switches controlling the inverter: an MOS and a 
control switch for each contactor. These contactor control switches cannot override the 
automatic control to close a contactor, only to open it. And the only function of the MOS 
is to disable the LBCS and TBCS. 

Indicators . - The indicator lights for the switches and contactors will light if the 
respective switch or contactor is closed. The automatic operation mode (AUTO) light 
will light if the MOS is off. The parallel operation (PARA) light will light, and a parallel 
control signal is sent to the paralleling circuits, if the LBC and TBC are closed. The 
isolated operation (ISO) light will light if the LBC is closed and the TBC is open. Either 
the inverter or converter light will light depending on the operating mode. 

The six fault indicators blink on during recycle, indicating the fault, and stay on 
after the latch is set. The equation for the abnormal voltage light is 


AViight = (AV + AV U ht ) (Fault reset x LBC + IC latch) 

The LBC always opens on an AV fault. The operation of the AF light is similar. But an 
AV fault, specifically undervoltage, may also be detected as an AF fault. Therefore, 
the AF light cannot come on if the AV light is on. 


AF light = ( AF X AV light + AF light^ Fault reset X LBC + IC latch ) 
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The LDP light will indicate if there is an LDP fault and a fault reset or TBC latch sig- 
nal. The TBF light requires an IOC fault and the fault reset or TBC latch signal. The 
LBF light indicates an LOC fault and recycle or an LC latch. 

The FRP light indicates a fault whenever the FRP detector senses a fault if the ICS 
is closed. A time delay of 0. 15 second is incorporated after the ICS is closed to allow 
the oscillator in the inverter to start. An FRP fault will be indicated even if the module 
is not supplying the reference signal, if the ICS is closed. 
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APPENDIX C 


CONTROL AND PROTECTION SYSTEM FOR INVERTER -CONVERTER SYSTEM 
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Intermodule Connection and Symbols 


42 














APPENDIX D 


ACRONYMS 


AF 

abnormal frequency 

AP 

automatic parallel 

AUTO 

automatic operation mode 

AV 

abnormal voltage 

COC 

converter overcurrent 

CONY 

converter mode light 

ER 

excessive ripple 

FRP 

frequency reference protection 

IC 

input contactor 

ICS 

input contactor switch 

INV 

inverter mode light 

IOC 

inverter over current 

ISO 

isolated operation light 

LBC 

load bus contactor 

LBCS 

load bus contactor switch 

LBF 

load bus fault 

LC 

load contactor 

LCS 

load contactor switch 

LDP 

load division protection 

LOC 

load overcurrent 

MAN 

manual operation mode 

MOS 

manual override switch 

PARA 

parallel operation light 

TBC 

tie bus contactor 

TBCS 

tie bus contactor switch 

TBF 

tie bus fault 
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